Facebook, Google Plus, Uncensored Search etc without a VPN

Submitted by martin on Tue, Mar 20, 2012

GreatFire.org's mission is to bring transparency to online censorship in China and to that end we are continuously making our own improvements to how we monitor blocked searches and key words. This past week we launched a new version of our web site where we now provide real-time searches so concerned netizens can keep up to date with information which is being censored via the Great Firewall of China.

We are also fortunate in that we have a core of super users who are constantly and consistently testing our technology to keep abreast of censorship in China. After we launched the new version of the site, we received this feedback from one of our super users via Twitter:

After receiving this message we logged on to Facebook, checked out Google Plus and did some searches on Google, specifically for freedom and 六四. What's so special about that? These websites and searches are blocked in China but we were able to access them without using a VPN or proxy, the tools people commonly use to get around this censorship.

How did we do it?

We launched a new version of the website last week, and among other things it detects types of blocking including the infamous Connection Reset. For some reason, however, it did not report Connection Reset for a test of YouTube on March 17 - nor any other type of censorship. All the data suggested that the encrypted version of YouTube was not blocked in China on that day. Could that be right?

Notice that I said the encrypted version. That means https://www.youtube.com, and not http://www.youtube.com. One single letter makes all the difference when it comes to Internet communication. When browsing a URL that starts with https://, all the traffic between you and the server is encrypted and therefore out of reach of any content-based filtering such as what's practiced by the Great Firewall of China (GFW). It means that the GFW cannot interfere with the connection based on it's content, such as the URL, any data sent in forms, or the response data. It can, however, interfere in other ways:

1. DNS Poisoning

In short, this means that the IP address returned for the requested domain is incorrect. This happened when our system tested YouTube again today (but not yesterday - which is why it seemed to be accessible). More on DNS Poisoning in our FAQ.

2. IP Blocking

This means that the actual IP address of the server where the website is hosted is blocked. All communication with this server is subsequently made impossible. However, this type of filtering is not very effective nowadays, because IP addresses tend to change frequently. Major websites use load-balancing and globally distributed hosting meaning that they have a range of IP addresses at their disposal. For example, if you go to google.com, and then again half an hour later, it may well direct you to different servers. The content looks the same, so you don't notice. You also don't care, because it's technical mumbo jumbo - unless, that is, you live in China or some other authoritarian country with major Internet censorship.

So what's the "So what?"

Let's put together what we have so far:

If the connection is encrypted (ie, the URL starts with https://), the Great Firewall cannot know what the content is and cannot block the request based on it's content.

It can however use other types of censorship, such as DNS Poisoning and IP Blocking.

If we can get around these other types of censorship, we can get around the Great Firewall!

DNS Poisoning is probably the least sophisticated type of Internet censorship tool that the Chinese and other strong-armed governments have at their disposal. To get around this type of censorship, all you need to do is to use an alternative DNS solution. Here's the juicy stuff:

Solution 1: Use IP addresses directly

Instead of using a DNS service, which can be and is manipulated by Chinese ISPs, you can enter the IP address directly. For example, instead of browsing to https://encrypted.google.com (which is blocked) you can browse to https://74.125.235.100 (which is, at the time this is written, not blocked). This is the encrypted version of Google, which means that you can search for anything, including the two examples mentioned at the beginning of this post, or any of the other 200+ searches that are otherwise blocked in China.

Another example is https://199.59.150.7 - at the time this is written, we're able to access Twitter on this URL.

Pros

You can access any blocked website if it has an encrypted version (a URL that starts with https://) and it's IP is not blocked.

Cons

You have to know the current IP address of the website (or one of them, there is often a range). IP addresses of major websites change frequently.

You have to enter IP addresses instead of domains every time you want to visit a blocked website.

Your browser will compain about the SSL cerficicate being invalid, because you're not accessing the website on it's real URL. You have to manually confirm an exception to access the website.

Some websites, such as Facebook, will redirect you to the domain if you try to acccess them directly through their IP.

Solution 2: Manually add IP addresses to your hosts file

What if you could tell your computer to remember that certain domains should resolve to certain IP addresses so that in the future you do not need to remember different IP addresses? Guess what - you can. Every operating system (that I know of) maintains something called a hosts file which is the local cache for DNS entries. Whenever you lookup a domain, such as www.facebook.com, your computer will first check this file and if there's an entry, it will use it. Normally it isn't used for anything, but it can be. All you need to do is to edit your hosts file (here's a tutorial on how to do it) and add entries for the websites you want to unblock. For example, to access Facebook, I added the following:

You can access any blocked website if it has an encrypted version (a URL that starts with https://) and it's IP is not blocked.

Cons

You have to know the current IP address of the website (or one of them, there is often a range). IP addresses of major websites change frequently.

(Non) Solution 3: Use a third-party DNS service

What if there was some alternative DNS service that you could use instead of trusting your ISP? Google provides just such a service called Public DNS. Moreover, it's not blocked in China. However, there is a major weakness to this approach. The DNS request to the third-party provider is not encrypted and so it can easily be blocked or tampered with by censors along the way, such as the GFW. We tried accessing some major websites that are blocked using Google's Public DNS and were unable to do so.

Solution 4: Use an encrypted DNS service

This is where it becomes really exciting. There's an application called DNSCrypt which provides a third-party DNS service (OpenDNS) over an encrypted protocol. In essence, this is a keyturn, free solution for getting around major parts of the online censorship in China. All you need to do is to 1) download and install the software (the download site is not blocked, so far) and 2) Make sure to use encrypted versions of blocked websites (eg https://twitter.com instead of http://twitter.com). Unfortunately, DNSCrypt only works with Mac OS so far.

Pros

You can access any blocked website if it has an encrypted version (a URL that starts with https://) and it's IP is not blocked.

Cons

It's for Mac only (so far).

You have to trust OpenDNS.

What about speed?

When you use a VPN or proxy to access blocked websites, all traffic is rerouted through your third-party servers. One drawback of this is speed. For example, if you are in China, your VPN server is in the US and the website you are browsing is in Singapore, every request you make is routed first to the US, then to Singapore, then back to the US and finally back to China. All this means that it's bound to be slower than if you could access it directly. Using the techniques described in this post, you can do just that: access blocked websites directly from China. It should be faster.

Overview

Let's put it all together to compare, and add in a general VPN solution for reference.

IP Address Directly

Hosts File

Google Public DNS

DNSCrypt

VPN

Access blocked websites

Y

Y

Y

Y

Y

Free of charge

Y

Y

Y

Y

N

Direct access to blocked website, avoiding third-party rerouting

Y

Y

Y

Y

N

Works for unencrypted websites

N

N

N

N

Y

Works if IP is blocked

N

N

N

N

Y

Does not require you to know IP addresses

N

N

Y

Y

Y

Does not require you to enter IP addresses instead of domains

N

Y

Y

Y

Y

Does not cause invalid SSL Certificates

N

Y

Y

Y

Y

Access websites that redirect you to their domain

N

Y

Y

Y

Y

Prevents DNS Poisoning

Y

Y

N

Y

Y

Available for all operating systems

Y

Y

Y

N

Y

Other notes

More and more websites are offering encrypted versions, and several are switching to HTTPS by default, including Google as well as our own GreatFire.org. This is changing the game for governments around the world that are trying to censor the Internet.

YouTube offers an encrypted version of its website but unfortunately the actual streaming of videos is not encrypted. This means that by using the techniques described in this post you can access YouTube (and it's fast!) but the actual viewing of videos won't work.

There's a Firefox and Chrome extension called HTTPS Everywhere which automatically redirects you to HTTPS versions of major sites.

What do you think?

Are you able to use these techniques to get around online censorship?

Do you know of other encrypted DNS services that work on other operating systems?

Are there other ways to use these tools?

How do you think this will affect future development of the Internet, attempts to censor it, and ways around the censorship?

Tue, May 23, 2017

Last week Twitter came under attack from a DDoS attack orchestrated by the Chinese authorities. While such attacks are not uncommon for websites like Twitter, this one proved unusual. While the Chinese authorities use the Great Firewall to block harmful content from reaching its citizens, it now uses DDoS attacks to take down content that appears on websites beyond its borders. For the Chinese authorities, it is not simply good enough to “protect” the interests of Chinese citizens at home - in their view of cyber sovereignty, any content that might harm China’s interests must be removed, regardless of where the website is located.

And so last week the Chinese authorities determined that Twitter was the target. In particular, the authorities targeted the Twitter account for Guo Wengui (https://twitter.com/KwokMiles), the rebel billionaire who is slowly leaking information about corrupt Chinese government officials via his Twitter account and through his YouTube videos. Guo appeared to ramp up his whistle-blowing efforts last week and the Chinese authorities, in turn, ramped up theirs.

Mon, Dec 12, 2016

It’s been three years since Eric Schmidt proclaimed that Google would chart a course to ending online censorship within ten years. Now is a great time to check on Google’s progress, reassess the landscape, benchmark Google’s efforts against others who share the same goal, postulate on the China strategy and offer suggestions on how they might effectively move forward.

Flowers left outside Google China’s headquarters after its announcement it might leave the country in 2010. Photo: Wikicommons.

What has Google accomplished since November 2013?

The first thing they have accomplished is an entire rebranding of both Google (now Alphabet) and Google Ideas (now Jigsaw). Throughout this blog post, reference is made to both new and old company names.

Google has started to develop two main tools which they believe can help in the fight against censorship. Jigsaw’s DDoS protection service, Project Shield, is effectively preventing censorship-inspired DDoS attacks and recently helped to repel an attack on Brian Krebs’ blog. The service is similar to other anti-DDoS services developed by internet freedom champions and for-profit services like Cloudflare.

Thu, Nov 24, 2016

Facebook is considering launching a censorship tool that would enable the world’s biggest social network to “enter” the China market. Sadly, nobody will be surprised by anything that Mark Zuckerberg decides to do in order to enter the China market. With such low expectations, Facebook is poised to usurp Apple as China’s favorite foreign intelligence gathering partner. If the company launches in China using this strategy they will also successfully erase any bargaining power that other media organizations may hold with the Chinese authorities.

Tue, Jul 05, 2016

There is a commonly held belief in China that if you have a VPN that works then you should keep quiet about it. In terms of freedom of access to information, the problem with this approach is that access to knowledge suddenly is a secret. Today we are launching a project that we hope will destroy that model.

Our newest website, Circumvention Central (CC), aims to provide real-time information and data about circumvention solutions that work in China. Since 2011, we have been collecting data about blocked websites in China and now we will add data about the effectiveness of VPNs and other circumvention tools.

We are launching CC with four main objectives in mind.

Our first objective is to help to grow the number of Chinese who circumvent censorship restrictions in China. By sharing our information and data about these tools, we hope to show a wider audience which circumvention tools are working.

Our second objective is to improve the circumvention experience for users in China by bringing transparency to tool performance. We will measure these tools on speed (how quickly popular websites are loaded) and on stability (the extent to which popular websites load successfully).

Comments

Submitted by Alex Jones on Thu, Jun 14, 2012

Good news regarding DNSCrypt - it is also available for Linux, and works well. I used the guide at http://www.ab9il.net/crypto/dnscrypt.html and was getting through the GFW for many more websites than before. Still need a VPN for Facebook, though.

Submitted by Indira on Thu, May 01, 2014

That is really attention-grabbing, You are an overly professional blogger.
I have joined your rss feed and stay up for in search of more of your
magnificent post. Additionally, I've shared your site in my social networks

It's great in desserts as long as it is 100% barley and doesn't have anything else such as corn syrup added to it.

The complete Green - Pan Stainless Steel Ultimate Gourmet Cookware Set is
easy to maintain and is dishwasher safe and includes a manufacturer's lifetime warranty.
Fold the cutlet around the stuffing as if you were making a burrito
or egg roll.

frеe live sex seem too dominate the oոline adult enteгttainment
ѡorld. Manny men and women use them for indiνiɗual recreatiօn so why might a guү or gal use live sex.
While in thhe era off the world wide web adult lustful connections are
getting tоo bbe tougher both ladies aոd mеn
hаve got made use oof free live sex sߋ that you
can release intimate aggravation. Yet itt іs no surprise to discokver
that you have even moгe guуs desiring free live sex compared to you will discover galks free live sex.
Eaϲh enjoy haѵing nwked bodieеs on cam either customarily wߋmen of all ages aгe much more particular
as compared to men. In terms of free live sex males are ovten aesthеtic humans ɑnd are
generallу easily sexual arouse Ьy simply live sex.
Women frequentlƴ desire psychological in addition to opticl arousal whilе νiewing live sex.
It iss easy to comprehend why males enjoy visiting uոԁressed fеmales ߋn livve
sex. Pying attention toօ bloondes on cam іs a major turn on for
them. Watching live sex camѕ aids de tensіon their νery own daily
life. It also helps diѕtrazct frοmm еѵery dayy pressurе.
After a loոg workinjg day doing work it helps. It's rеally a іԀentified indisputable fact that jerking off freeѕ anxiety and produces chemical substanceѕ in the body that calm.
There will be a lot of judgment linked to viewіng live ssex cams on
the աeb. Generally there mustn't be. It is ɑ wholesome Ԁepictiߋn reցarding libido.

This is very interesting, You are an overly skilled blogger.
I have joined your feed and look forward to looking for extra of your excellent
post. Also, I have shared your website in my social networks

Hi! This is my first visit to your blog! We are a team of volunteers
and starting a new project in a community in the
same niche. Your blog provided us useful information to work
on. You have done a extraordinary job!

Submitted by Harry James on Mon, Oct 23, 2017

is really simple. We just need to go to the Mobdro download web page Mobdro for Chromecast online, after that Mobdro app is an excellent app to have.

Submitted by James on Thu, Nov 16, 2017

It is an open resource system, there are extra designers adding PlayStoreGuide which is offered with iTunes. Applications downloaded and install via Google Play

Submitted by jarry on Sat, Jan 13, 2018

It will certainly alert the business of prospective concerns different website McDonald's is among the biggest chain of junk food dining establishment worldwide.